IETF Logo Mail Archive

[OAUTH-WG] Draft for “web_message” Response Mode - Asking For Feedback

Karsten Meyer zu Selhausen | Hackmanit <karsten.meyerzuselhausen@hackmanit.de> Thu, 23 November 2023 09:12 UTC

Return-Path: <karsten.meyerzuselhausen@hackmanit.de>
X-Original-To: oauth@ietfa.amsl.com
Delivered-To: oauth@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 16A40C1519BA for <oauth@ietfa.amsl.com>; Thu, 23 Nov 2023 01:12:05 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.105
X-Spam-Level:
X-Spam-Status: No, score=-2.105 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_ZEN_BLOCKED_OPENDNS=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01, URIBL_BLOCKED=0.001, URIBL_DBL_BLOCKED_OPENDNS=0.001, URIBL_ZEN_BLOCKED_OPENDNS=0.001] autolearn=ham autolearn_force=no
Authentication-Results: ietfa.amsl.com (amavisd-new); dkim=pass (1024-bit key) header.d=hackmanit.de
Received: from mail.ietf.org ([50.223.129.194]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Bp5l-y-Eskl0 for <oauth@ietfa.amsl.com>; Thu, 23 Nov 2023 01:12:00 -0800 (PST)
Received: from mail-lf1-x12d.google.com (mail-lf1-x12d.google.com [IPv6:2a00:1450:4864:20::12d]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by ietfa.amsl.com (Postfix) with ESMTPS id 6F514C15155C for <oauth@ietf.org>; Thu, 23 Nov 2023 01:11:59 -0800 (PST)
Received: by mail-lf1-x12d.google.com with SMTP id 2adb3069b0e04-5079f3f3d7aso879708e87.1 for <oauth@ietf.org>; Thu, 23 Nov 2023 01:11:58 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=hackmanit.de; s=google; t=1700730716; x=1701335516; darn=ietf.org; h=autocrypt:content-language:cc:to:subject:from:user-agent :mime-version:date:message-id:from:to:cc:subject:date:message-id :reply-to; bh=O4l0Fn1/f09TzsbHa7bZ1vqOJXsq+3Ldg8hZSF8jZnY=; b=duvy45X3c+u5cKbCtCVXZmeDb/uG5gId4yqMpg5IF9Qx/d1vEaLEF2Tr5C6UXYx2/+ +/LHE/pSlpr8KRecSCPcSOqH3uJZHJvm9lyrgMFqprRdpvnWx8J20p7a2EWh2Qpp7BqF tDgPIlB7yniKChQGv1PsDFafMEFTWyZS56vLk=
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1700730716; x=1701335516; h=autocrypt:content-language:cc:to:subject:from:user-agent :mime-version:date:message-id:x-gm-message-state:from:to:cc:subject :date:message-id:reply-to; bh=O4l0Fn1/f09TzsbHa7bZ1vqOJXsq+3Ldg8hZSF8jZnY=; b=i36eHGUewv+0Fqm+LJ+/yRlnVsmuhrlJ1xrKKm+J8K7FXZWWup7Tm07KMaQwXEWKDE hku2VRhYySwyP9/lTi7qCvsau81B4qQpP45exJ7e/x5I+h1/k7h6YZpKbVfB0JA+LO0V ZaxDEGgtFC08XZ1d2bsZ2tFp0jViwBiuCrBzOtZh06NOkiNJg0fhofNjrzs8gTtaCifK 7QSNDK8QEv7uZpnQU1CTkA3SHeTjbzK85EM1Go61q4fSLP7hZ7xGGLwrE5vfDm/CrkG1 9kwp+s2XQXdSfKDR3NBRpHWLZTaYffMdZ93msDKVTSy9jIYIMoQGZ1xtQZpuLisO/u9O PRcQ==
X-Gm-Message-State: AOJu0YyZR6AIcW2LsC4E/0A5fBc4r9DOf6SmcTpuZrDUo7mLkjJcpCrO zugTNja0defs5spijyJKdSBuUT8c6tZmqYndnF6hvA==
X-Google-Smtp-Source: AGHT+IGGZ8JO0OF6T4oHAmqux5Yn697KSCfUQZimCo5OhoBLscapuczcVtheMJLTf5f0mzQ7celyXA==
X-Received: by 2002:ac2:4289:0:b0:509:494d:c3d5 with SMTP id m9-20020ac24289000000b00509494dc3d5mr3070596lfh.26.1700730715863; Thu, 23 Nov 2023 01:11:55 -0800 (PST)
Received: from [192.168.137.33] (ip-037-024-087-133.um08.pools.vodafone-ip.de. [37.24.87.133]) by smtp.gmail.com with ESMTPSA id l5-20020a5d4105000000b00332c0d256c5sm1045940wrp.80.2023.11.23.01.11.54 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Thu, 23 Nov 2023 01:11:55 -0800 (PST)
Message-ID: <ea11f400-45b4-4ef2-a926-f3f89697bca9@hackmanit.de>
Date: Thu, 23 Nov 2023 10:11:55 +0100
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
From: Karsten Meyer zu Selhausen | Hackmanit <karsten.meyerzuselhausen@hackmanit.de>
To: oauth <oauth@ietf.org>
Cc: Louis Jannett <louis.jannett@rub.de>, Christian Mainka <christian.mainka@hackmanit.de>
Content-Language: en-US
Autocrypt: addr=karsten.meyerzuselhausen@hackmanit.de; keydata= xsFNBFh1IBMBEADV73c10lB7zeFy6/ezLFzOBp8z6Zy1zUyIrf6RoBk1GQWREcGEGeaL90Pj F5plZeASVJdsEYnYXdgcIPE0tlBq6al6OYoWtH/VbFPWEPLVhA3rL1iXVJveD3J40OzSYP8N G7bla3zQ2+TXOB3iDPPsHZUdHCLASkIIWQK6+fE1C2epAdPtnsLsb++1d080jfXXwgyUUh4y bimcy9Jg5oZ4QMwnSq3Y+x38PNb+nTgjDi1X/89/WsNd7Bdh4Zvw3CAuc/W58CFaDjb7liUD YRoAp6ysnjPKEUSnAnMpgaiXJc1gFoL+ahdKJ3D9XTn28NTjUrvOkVidsuKbyxnXP9I6BO6i 2jzjrH6TEAfIYMjZlYTyPZTt271SW5iAHYwvPZWlqQTBT2P/d4gHl0To5b4e+UXxjQgxqUyi QIcxh3Ris21Kx4lKQKDXYWiwNTZzx8AdqrcxCWfK+MRpFyk0B+4uDMm7Apm5ZWwDKN/JnVsJ yokkkrrHs/elRCUGtN9NyhJQf3VnE87862Pej8PVvQJr3uVnoNX2yieTvJZftIOBG1b9ta6Z BcYyn3un1rSn7lBPg+RSnPemposVorQpjGwT+Dhg13Bpv5q0JfSc//js/nB6A4iq5YssdtQ7 35QBWLLaF1oCxalvrQVDD4Sh06eAUQsga9xeE0yv7sxqdsozdwARAQABzUJLYXJzdGVuIE1l eWVyIHp1IFNlbGhhdXNlbiA8a2Fyc3Rlbi5tZXllcnp1c2VsaGF1c2VuQGhhY2ttYW5pdC5k ZT7CwX8EEwEIACkFAl/4WSsCGyMFCQ+L3RcHCwkIBwMCAQYVCAIJCgsEFgIDAQIeAQIXgAAK CRBFNcDn2xbxSKWlD/9BVhp53BFytM1EQ17x1TB76zFygZA33KZeQIWLkw/M8yWkuzgGTFJ8 Lx+kmC3xnk4WG6nIv4paU4y+K2+WlAQg3FR0CN0oHgb6gOSHu9ISDMdZm8Kzmie2hKSOG8wA 56oVhRYXElt3Oe22usywpcfCf8C1t0SjHkufUWgVFspaplKsEN6NwdSBLxQ0gzfEkl3RTfLV JEopw5MlLzKxM1EAbL0QZdORX6cIJI96BecnXA0fwlV2PmM+TSPUDzBFOneZBOdtgCduKVhG bVRDOtJ4LIEQFT7ZvlzYEaWueh8HNC6Y8wZKRaZ4cg8mXJuz+BizA8EEicubkqljKNlTuHB4 0l3R30m4w202U3XNDKmCsLGUVLfNet4mM3wLIw5sr9GUuDvz0+8J9eaAypqgU9NKfUHpecHC /AULjk7TK9hKq2o2mQCRiOOt4Ki6yeC068nQrE97eCS7/YikVHA7TXTchG82x4eqRpgyBonk uRwnuU3sGAty1+D1ehDFzTvGfh9GS8tncKgyAtj9acUIhYDW6yWesSX6B4OenXKnJhjbskAZ LFVegXWAPf1YT3ImCLBnhn8g7ZHwB/icyMaWCXURsO63beRhvAFjXNxKcL6f7gg8uW9z3GhR +Kcz2DRAWO6Xo8MBbed+Nc9z01jSNQBQa5SPnJaeBtfiUY+ZbmHfLs7BTQRYdSATARAAsp2V mr3N7iNND8+M/OyA/OwcDQ6utZh+m4TnKsOVdiNLGpu2U3/2Qg3yrbjic2dWx1CsS6VH2/oO 1e/a4FlxA93wFv/OZjiUjHtEvdIJeHWlCvWOUlMsqyGDc3Q75fNjFw6DGKkiOu9lZaBs6naS BmkvAMGjV5bNKLyIL5j7Im1pCdZ2lCjD7eVwR3RQQKobTmu916htX8g1cB9yFmquu37X+ZBl A4GLJi63Kw0L2r8i8iO1NqDLOfT8IeNkOroEm3SDAuEApGAubKLSPBJ1khQ7kDhpdfzSYKUF tiIHpGWVOImDjqf4JIcF7OIdRPQfFPlwoPnsyBAS8znQJvmqbbMowgFZe3UMLAN78CETZHGM OLBPB873oWyZ07Ar4v/SL5/aD+FRj2VnYEcGwt0HMmMyaN6ed8Udj4OTNZ7ceZA1Tw8/lZuI KCamj0XfJIK6376RCGnqjsEfS65P1KWZXfWphCKWp2c7uWKtau1q8pgiVRoBSAmjvfXRrIvK LhhQyNOiCUDKrvEWpoeq9y5GTrY27ncLov8nSR/SUPOw5HwJmzdFjhOF9XAOtiND/QRH886O IohdlnUu668mwLCmL2ROe7XWcTkFQWLDg+5b0bC9dgfL+HHpWGUdQPG3CCyPG5LfDmnmuXkE eU1kSD27kFe1kM6pfqpCydJW66DuwoMAEQEAAcLBlwQYAQgADwUCX/hZKwIbDAUJD4vdFwA8 CRBFNcDn2xbxSAkQRTXA59sW8UgJEEU1wOfbFvFICRBFNcDn2xbxSAkQRTXA59sW8UgJEEU1 wOfbFvFIQHUP/jKpA/Xco+eCnh1t4jR9c/8AiE1JR+3txOvsaMK8bWjnDtY5bIxOVvVPMUAI DUjNhSWVbHxPt+sZxEol+6oo9IP6MnWYxgx3IW2BWQUlYDyXzH3S8t7YxVo92+yD4kgZLOdq sKEJ2efr8OSgL4tcbAWA36UB8bOOHkOUXzoLLVN4qjuyRn9BPADGpcfxXEQb9iGVwbEZzfJ6 OtvbOHO0qfI3aX7btjqo2muhD1B8auhLQBVOfpn7LOnL8Hk6QKvkFEC3nqBMQbFUSLarmtXa o4cXSyLDmj+efMhbaimgbwxTxh125/ZaYE1q+LdHyHtbbPLAaxHr3dxPk1p0rjQxxXKG7k0p aal8dcVxp0yGEXOeuXr7Xba+uquF1wLf8kZRD0g7L31py3ay3cw+f3ADF/AgC+8lrlUlODa9 +z9sU7RKGF0fAY1gXV8P6GGPlVGJronrSIM2nSMkcCRJzg9vmPGAvrljQTqDQOf12s0jtevq VelIncMyQacOmw6DGKXsUiGRMNsobYe2BWrfXxoYFZ/0biIPnlY23MImgFUWZjnjD1jvkMzH 0u16cXBgjEAkPq5xy21RvXkwCt4T3XzOglDsxi22jmCSLTx45CGkEJaHLJ9tllkjrd3dQVIw P8hzeF0pGduCQAurcejd++jxzlqDk1hIuG9BqPySrt5AIMEG
Content-Type: multipart/signed; micalg="pgp-sha256"; protocol="application/pgp-signature"; boundary="------------S0tXS5y8My1jPlD29babcAGi"
Archived-At: <https://mailarchive.ietf.org/arch/msg/oauth/Bx69htm3rFt1kIKjC8gv7mDkKhs>
Subject: [OAUTH-WG] Draft for “web_message” Response Mode - Asking For Feedback
X-BeenThere: oauth@ietf.org
X-Mailman-Version: 2.1.39
Precedence: list
List-Id: OAUTH WG <oauth.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/oauth>, <mailto:oauth-request@ietf.org?subject=unsubscribe>
List-Archive: <https://mailarchive.ietf.org/arch/browse/oauth/>
List-Post: <mailto:oauth@ietf.org>
List-Help: <mailto:oauth-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/oauth>, <mailto:oauth-request@ietf.org?subject=subscribe>
X-List-Received-Date: Thu, 23 Nov 2023 09:12:05 -0000

Hi everyone,

at the last OSW the topic of a response mode based on the postMessage 
API came up. This approach is already used by multiple parties (e.g., 
Google) but lacks standardization.

There was some sense of agreement that it would be a good idea to create 
an RFC defining this response mode to counter security flaws in 
individual implementations and improve interoperability.

Because the efforts in the past were long expired (draft -00 of 
https://datatracker.ietf.org/doc/draft-sakimura-oauth-wmrm/ expired in 
2016) we took the initiative and started to work on a new ID for the 
"web_message" response mode.

*We would like to to ask the members of the working group for feedback 
on our draft: 
https://datatracker.ietf.org/doc/draft-meyerzuselha-oauth-web-message-response-mode/*


I see that "draft-sakimura-oauth-wmrm" has been recently updated. 
However, there have not been any changes to its contents. What are the 
plans of the authors for this draft?

Best regards
Karsten

-- 
Karsten Meyer zu Selhausen
Senior IT Security Consultant
Phone:	+49 (0)234 / 54456499
Web:	https://hackmanit.de  | IT Security Consulting, Penetration Testing, Security Training

Multi-Factor Authentication (MFA) significantly increases the security of your accounts.
Learn in our blog posts what the best MFA options are and how FIDO2 goes one step further to solve the world’s password problem:
https://www.hackmanit.de/en/blog-en/162-what-is-mfa
https://www.hackmanit.de/en/blog-en/165-what-is-fido2

Hackmanit GmbH
Universitätsstraße 60 (Exzenterhaus)
44789 Bochum

Registergericht: Amtsgericht Bochum, HRB 14896
Geschäftsführer: Prof. Dr. Jörg Schwenk, Prof. Dr. Juraj Somorovsky, Dr. Christian Mainka, Prof. Dr. Marcus Niemietz

v2.23.0 | Report a Bug | By Email